ClawHub
Back to skill

Security audit

看盘之眼

Security checks for vulnerabilities and agentic risk

Overview

This looks like a stock-chart OCR helper, but it needs Review because it can control a live trading window, capture financial screenshots, and send images to cloud OCR services with weak scoping.

Install only if you are comfortable with a Windows skill that can focus and type into a trading app, take screenshots, save them locally, and use cloud OCR. Prefer local OCR, remove or rotate embedded credentials, verify the exact target window before running it, and avoid using it while unrelated sensitive windows are visible.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (90)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
Write-Output $foundTitle
}}
'''
    result = subprocess.run(
        ['powershell', '-Command', ps_script],
        capture_output=True,
        text=True,
Confidence
91% confidence
Finding
This PowerShell invocation embeds untrusted input (`title_pattern`) directly into a script string passed to `powershell -Command`. An attacker who can influence the window-title argument could break out of the quoted string and inject arbitrary PowerShell, turning a window lookup into code execution.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
Write-Output "OK"
'''
    result = subprocess.run(
        ['powershell', '-Command', ps_script],
        capture_output=True,
        text=True,
Confidence
88% confidence
Finding
The screenshot routine interpolates `hwnd` and `output_path` directly into PowerShell source. If either value is attacker-controlled or malformed, it can lead to PowerShell script injection or unsafe file writes, enabling code execution or overwriting arbitrary files.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
Remove-Item $jpegPath -ErrorAction SilentlyContinue
'''
    
    result = subprocess.run(
        ['powershell', '-Command', ps_script],
        capture_output=True,
        text=True,
Confidence
80% confidence
Finding
The script builds a large PowerShell program as a string and executes it via subprocess, which increases attack surface and makes input handling fragile. Although image_path is internally generated, this design still enables script injection risks if path construction changes and unnecessarily delegates network/OCR logic to a shell interpreter.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
'''.format(width, height, abs_left, abs_top, output_path.replace(os.sep, '/'))
    
    try:
        result = subprocess.run(
            ['powershell', '-Command', ps_script],
            capture_output=True,
            text=True,
Confidence
84% confidence
Finding
The script launches PowerShell with a dynamically constructed script string to capture the screen. Although the current interpolated values are mostly numeric coordinates and a local output path, invoking an additional scripting engine increases attack surface and can become dangerous if path or arguments are ever influenced by untrusted input or contain escaping edge cases.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_command(cmd, check=True):
    """运行命令并返回结果"""
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,
Confidence
95% confidence
Finding
The helper executes arbitrary command strings with shell=True, which makes any interpolated or user-influenced value subject to shell interpretation. In this file, that becomes dangerous because later calls embed user-provided Baidu API and Secret keys into shell commands, creating a command-injection path on Windows.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
'''

# 运行PowerShell
result = subprocess.run(
    ['powershell', '-Command', ps_script],
    capture_output=True,
    text=True,
Confidence
93% confidence
Finding
The script launches PowerShell from Python to execute desktop-enumeration logic. Spawning an external shell increases attack surface and operational capability, and here it is not necessary for the stated OCR-focused purpose, making the behavior risky in an agent skill context.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
        # 执行PowerShell脚本
        result = subprocess.run(
            ['powershell', '-ExecutionPolicy', 'Bypass', '-File', ps_file],
            capture_output=True,
            text=True,
Confidence
90% confidence
Finding
This code launches PowerShell to execute a dynamically generated script and explicitly uses ExecutionPolicy Bypass. Although the immediate purpose is OCR, invoking a general-purpose scripting engine expands the skill's execution surface and can be abused if untrusted input such as the image path is embedded into the script content, or if the generated script file is tampered with before execution.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
f.write(ps_cmd)
            ps_file = f.name
        
        result = subprocess.run(
            ['powershell', '-ExecutionPolicy', 'Bypass', '-File', ps_file],
            capture_output=True,
            text=True,
Confidence
90% confidence
Finding
The alternate OCR path repeats the same risky pattern: it writes a PowerShell script to a temp file and executes it with ExecutionPolicy Bypass. This introduces unnecessary code-execution capability for a screenshot/OCR skill and increases the chance of script injection or local tampering around the temporary script and file-path handling.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documentation indicates capabilities to read/write files, access environment variables, invoke shell commands, and use networked OCR services, yet no permissions are explicitly declared. This creates a transparency and consent problem: operators may invoke a skill that exfiltrates screenshots or uses broader host capabilities than expected.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The stated purpose is narrowly framed as extracting MA values from a specific trading terminal, but the documentation also supports enumerating all visible windows, operating against different window titles, and sending images to external OCR providers using embedded credentials. That mismatch is dangerous because it hides materially broader collection and automation behavior than users would reasonably expect.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill promotes external cloud OCR even though the core use case appears to be local screenshot capture and text extraction. Sending screenshots of a live desktop trading application to third-party services can expose sensitive financial or personal information beyond what the user expects.

Intent-Code Divergence

Medium
Confidence
82% confidence
Finding
The skill claims to target '通达信金融终端' but elsewhere defaults to '金长江' windows and gives instructions for automating that software. Inconsistent targeting increases the chance of operating on the wrong application window, causing unintended desktop control or capture of unrelated sensitive content.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The script uploads screenshots of a live trading window to a third-party OCR service, but the skill description does not disclose any external transmission. Trading screenshots can contain sensitive financial data, account information, or other on-screen content, so undisclosed exfiltration to an external service materially increases privacy and data leakage risk.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The script does more than passively capture a screenshot: it forcibly brings an external trading window to the foreground and injects keystrokes to change application state, including clearing input, entering a stock code, and switching chart modes. In a financial terminal context, unsolicited UI automation is security-relevant because it can affect the user's active session, act on the wrong window if title matching is imprecise, and create a path for unintended or unauthorized interaction beyond OCR.

Context-Inappropriate Capability

Low
Confidence
79% confidence
Finding
Enumerating all visible window titles exposes information about other applications and documents open on the desktop, which may include sensitive names or workflow details unrelated to the stock OCR task. While not directly destructive, this is an unnecessary discovery capability that broadens access to user environment metadata and can assist mis-targeting or reconnaissance.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
Enumerating and printing all visible window titles exposes unrelated desktop/application metadata that is not necessary for MA/OCR extraction. Window titles often contain document names, account identifiers, chat previews, or sensitive operational context, so this expands data access beyond the stated purpose.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill injects synthetic keyboard input into the active desktop session without binding input to a verified target window. If the wrong window has focus, it can trigger unintended actions such as sending messages, altering orders, dismissing dialogs, or interacting with sensitive applications.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Desktop-wide window enumeration is an unnecessary inspection capability for the stated task of capturing a stock chart and extracting MA values. In the skill context, this overbroad visibility increases privacy risk because it can reveal unrelated application usage and sensitive titles.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill metadata says it operates on 通达信 screenshots, but the code actually searches for and manipulates a different trading client window titled “金长江”. This mismatch is security-relevant because users may grant trust based on the stated scope while the code targets a different application and its on-screen data.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The description presents the tool as OCR over screenshots, but the code also sends synthetic keystrokes to a foreground trading application to change symbols and chart modes. Hidden UI automation is more dangerous than passive OCR because it can alter application state, interfere with user actions, and create opportunities for unintended interaction with sensitive software.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The script hardcodes Baidu OCR credentials and sends local screenshot data to an external cloud OCR service. In the context of a skill described as screenshot/OCR for a local trading terminal, this creates a significant confidentiality and supply-chain risk because sensitive trading data may leave the host without explicit, documented consent.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill captures part of a live trading terminal window and transmits the image to a third-party OCR API, despite the skill description implying local screenshot OCR. This creates an undisclosed data exfiltration path for potentially sensitive financial data, account identifiers, watchlists, or proprietary trading context visible in the screenshot.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code embeds a hardcoded OCR.space API key and couples the skill to an external service without clear justification or user awareness. Hardcoded credentials are easy to leak, misuse, or rotate poorly, and they normalize hidden third-party dependencies in a tool processing sensitive screenshots.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill presents itself as OCR for local stock-chart screenshots, but it actually uploads captured chart images to the external OCR.space service. This is a material data-flow mismatch that can expose potentially sensitive trading information, account context, or workstation screen content without clear user awareness.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script captures part of a trading application window and sends the image to a third-party OCR service over the network. This creates a real data-exfiltration/privacy risk because screenshots may contain holdings, account data, watchlists, or other sensitive trading information, and the external transmission is not clearly disclosed in the skill description or gated by explicit consent.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:159